s3-security-scanner v1.0.2

s3-security-scanner v1.0.2

Adds detection for a stealthy, under-discussed S3 attack: replication used as
a data-exfiltration backdoor.

Added

• Cross-account replication detection (CRITICAL). When a bucket replicates
  objects to a destination in a different AWS account, the scanner now
  raises a CRITICAL external_account_replication finding and deducts 20 from
  the bucket's security score. This catches the case where an attacker who can
  call s3:PutReplicationConfiguration turns S3's own replication engine into a
  continuous exfiltration pipeline: every new object is auto-copied to the
  attacker's account, and the rule keeps running even after the attacker's
  access to the source bucket is revoked.
• --trusted-account option (repeatable). Allow-list known-good
  destination accounts (for example a legitimate DR account) to suppress the
  finding for those accounts.
• New fields on the replication check: has_external_replication,
  external_destinations, and destinations.

Changed

• Replication is no longer treated as purely beneficial. Same-account / DR
  replication is unaffected; only cross-account destinations are flagged.

Why it matters

Most S3 tooling treats replication as a resilience feature and only warns when
it is missing. Replication to an external account is a real persistence and
exfiltration technique that survives credential rotation. This release closes
that blind spot.

Notes

• No breaking changes. Full test suite passing (124 tests).

Upgrade

pip install --upgrade s3-security-scanner
# or
docker pull tarekcheikh/s3-security-scanner:1.0.2

Example

# flag cross-account replication backdoors
s3-security-scanner security

# allow a known DR account
s3-security-scanner security --trusted-account 111122223333